VMware ESXi and vSphere Cluster Management

How to Share a Report in Splunk

Learn how to change Splunk report permissions, choose private, app-level, or all-app sharing, assign role-based read and write access, and validate the result.

A Splunk report is a saved search that can be run, scheduled, visualized, or used as the basis for other objects. Because a report is a Splunk knowledge object, it has an owner, an app context, and permissions that control who can use or change it.

A newly created report is private by default. To let other users or teams use it, change its sharing scope and assign appropriate role-based permissions.

Prerequisites for Sharing a Report

• You must already have a saved Splunk report.
• Your user account must have sufficient permissions to modify the report's sharing settings.
• Your role and the current app configuration can affect which sharing choices are available.
• You should understand the target users' roles and their access to the report's underlying data.

If you cannot see a Permissions control or cannot save changes, contact a Splunk administrator or the owner of the knowledge object.

Open the Report Permissions Interface

1. Open Splunk Web and go to Settings.
2. Select Searches, Reports, and Alerts.
3. Locate the saved report you want to share. Use the app context, owner, and report name to distinguish it from similarly named objects.
4. Open the report's Permissions control.

Settings > Searches, Reports, and Alerts > locate report > Permissions

The exact labels or available choices can vary with Splunk version, app configuration, and your authorization. The management page is the central location for changing permissions on saved reports.

Choose a Report Sharing Scope

The sharing scope determines where the report is available. Choose the narrowest scope that meets the reporting requirement.

Private

Private access limits the report to its owner. The owner can use and modify it, while other users cannot locate or run it through the shared reporting interface.

This App Only

App-level sharing makes the report available within the selected app context. This is appropriate when a report belongs to one operational workflow and does not need to appear in other apps.

All Apps

All-app sharing makes the report eligible for use across Splunk apps. Users still need the appropriate role permissions, and their data access remains independent of the report's sharing setting.

Assign Role-Based Access

A role is a Splunk authorization grouping that determines users' capabilities and access. In the permissions interface, assign one or more roles to the report's read and write permission lists.

Granting read access to the Everyone role is a broad way to make a report readable by all users covered by that role. It does not make those users editors unless write access is also granted.

Save and Validate the Changes

1. Choose the required sharing scope: Private, app-level sharing, or All apps.
2. Add the appropriate Splunk roles to the Read permission list.
3. Add only trusted maintenance roles to the Write permission list.
4. Save the permission changes.
5. Test the report with a non-owner account that has the intended role.
6. Verify that the report appears in the intended application context and that it can be opened and run.
7. If write access was granted, test with a maintainer account and confirm that a consumer account cannot edit the report.

Testing with an account other than the owner helps reveal differences between the owner's privileges and the permissions granted to ordinary users.

Practical Sharing Examples

Share a Report with Every Splunk User

1. Go to Settings > Searches, Reports, and Alerts.
2. Find the saved report and open Permissions.
3. Set the sharing scope to All apps.
4. Grant Read access to the Everyone role.
5. Leave write access restricted unless a specific maintenance team needs it.
6. Save the changes and test visibility with a non-owner account.

Expected result: Authorized Splunk users can locate and view the report across apps, while editing remains restricted unless write access is separately granted. Users still need access to the report's underlying data to receive complete results.

Share an Operational Report with One App's Users

1. Open the report's Permissions settings.
2. Choose the app-only sharing scope.
3. Grant read access to the relevant operational role.
4. Optionally grant write access to a smaller analyst or administrator role.
5. Save and test the report from the selected app.

Expected result: The report is available to the intended role within the selected app without becoming broadly available in other apps.

Let a Reporting Team Maintain a Shared Report

1. Choose the scope appropriate for the consumers, such as the current app or all apps.
2. Grant read access to the report-consumer role or roles.
3. Grant write access only to the reporting-maintainer role.
4. Save the settings.
5. Validate both a consumer experience and a maintainer experience.

Expected result: Consumers can run the report, while designated maintainers can update its definition and settings.

Report Sharing and Data Access Are Different

Report availability controls access to the saved search object. It does not override authorization for the data searched by that object.

A user may be able to see and open a shared report but receive incomplete or no results if their role cannot search the required indexes, sourcetypes, or other data sources. Role-based search filters can also limit the results. Review data access separately from report permissions.

Troubleshooting

Another User Cannot Find or Open the Shared Report

• Confirm that the report is not still private.
• Check whether it was shared only within a different app.
• Confirm that the user's effective role membership includes a role with read permission.
• Verify that the permission changes were saved.
• Retest from the target user's application context.

The User Opens the Report but Sees No Results or Fewer Results

• Review the user's access to the indexes and data referenced by the report.
• Check whether role-based search filters restrict the user's results.
• Confirm that the user's role can search the required indexes and sourcetypes.

The User Can View the Report but Cannot Edit It

• Read permission may have been granted without write permission.
• The user may lack capabilities required for the intended edit.
• Grant write access only when editing is required, then review the role's capabilities using least-privilege access.

The Report Is Visible in One App but Not Another

The report is probably scoped to a single app. If cross-app availability is required, change the scope to All apps, reassess role permissions, save the change, and test again.

Access-Control Review Checklist

• Use private sharing for drafts and personal reports.
• Use app-level sharing when the report belongs to one application or operational team.
• Use all-app sharing only for reports that genuinely need cross-app availability.
• Grant read access to the smallest set of roles that needs the report.
• Grant write access only to trusted maintainers.
• Test with both consumer and maintainer accounts.
• Check underlying index and sourcetype access when results differ between users.
• Review permissions when ownership, app usage, team membership, or reporting requirements change.

For a related guide, see sharing a Splunk report.